How to Resolve 'Received fatal alert: handshake_failure' in Client-Authorized SSL Connections?

Troubleshooting "Received fatal alert: handshake_failure through SSLHandshakeException"

Problem Overview:

An SSL connection fails with a "handshake_failure" error during client-authorized SSL communication.

Potential Causes:

• Incompatible cipher suites
• Incompatible SSL versions
• Incomplete certificate trust path
• Incorrect server certificate

Debugging Steps:

To pinpoint the exact cause of the handshake failure, enable debugging with the -Djavax.net.debug=all flag.

Key Findings from Debugging Output:

Keystore and Truststore Information:

Examine the listed keystore and truststores to ensure they contain the correct certificates.

ClientHello:

Verify that the cipher suites in the ClientHello message match those specified in the merchant.properties file.

ServerHello:

• Cipher Suite: Check if the server has chosen a supported cipher suite.
• Certificate: Examine the server's certificate chain to identify any potential trust issues.

Trust Certificate Verification:

• If the ServerHello does not include a certificate or a "Found trusted certificate" message, the root CA for the server's certificate may be missing from the truststore.

Resolution:

Based on the debugging results, the following resolutions can be explored:

• Ensure that the client and server use compatible cipher suites and SSL versions.
• Import the server's certificate issuing CA into the client's truststore if necessary.
• Verify that the server certificate is valid for the intended hostname.

Additional Considerations:

• The trust store contains certificates from CAs that are trusted by the JVM. Adding untrusted certificates can compromise security.
• Understanding the JSSE trace output requires familiarity with SSL/TLS protocols. If needed, refer to external resources or seek professional assistance.

The above is the detailed content of How to Resolve 'Received fatal alert: handshake_failure' in Client-Authorized SSL Connections?. For more information, please follow other related articles on the PHP Chinese website!